Data Security

The short version

• We never see Your bank login. Bank and card accounts are linked through Plaid; Your online banking credentials go directly to Plaid and are never transmitted to or stored by Us.
• We never see Your card number. Subscription payments are handled by Stripe. We store only a customer reference, plan status and the card's brand and last four digits.
• Your Amazon password is encrypted with AES-256-GCM before it is stored, with a key that lives only in Our server environment — never in the database or on Your device. It is used solely to re-establish Your Amazon connection when it expires, and it is deleted the moment You disconnect Your Amazon account.
• Everything is encrypted in transit with TLS 1.2+ between Your browser, Our servers and every provider We use, and encrypted at rest by Our database provider.
• Your data is Yours. Access controls in Our database mean each user's data is only readable by that user. We do not sell it, do not use it for advertising and do not use it to train AI models.
• You can delete everything, instantly. "Delete account" in Settings revokes Plaid access, wipes Your Amazon credentials and connection data, deletes Your uploads and removes Your Account.

How We connect to Amazon

Amazon does not offer a consumer API for order history, so We sign in to Your Amazon account on Your behalf using an isolated, sandboxed connection. Each user's connection is separate; nothing is shared between users.

• Credentials. Your Amazon email and password are sent to Our API over TLS, encrypted with AES-256-GCM (authenticated encryption) and stored only in that encrypted form. The encryption key is an environment secret on Our servers and is never written to the database, logs or analytics.
• Two-factor codes. One-time codes You enter are used once to complete sign-in and then discarded. They are never stored.
• Read-only by design. We only read Your order history, order details, returns, gift-card and registry information. We do not place orders, change account settings or take any other action in Your Amazon account.
• AI parsing. To turn Your order information into structured data We send the order text to a third-party AI processing provider. Only order content is sent — never Your credentials or bank data — and the provider processes it as Our service provider under terms that prohibit using it to train models.
• Disconnecting. Disconnecting Your Amazon account deletes the stored credentials and all associated connection data. Changing Your Amazon password also immediately invalidates Our access.

How We connect to Your bank (Plaid)

Plaid is the same infrastructure used by Venmo, Robinhood, American Express and thousands of other financial apps. When You link an account:

• You enter Your bank credentials in Plaid's own secure widget. They are transmitted to Plaid, not to Us. We have no way to see them.
• Plaid returns a long-lived access token that lets Us fetch transactions. We encrypt that token with the same AES-256-GCM scheme before storing it.
• We request read-only transaction data: institution and account names, masked account numbers (last four digits), and transaction dates, amounts and descriptions. We cannot move money, and We do not receive Your full account or routing numbers.
• Unlinking an account revokes the token with Plaid, so neither We nor Plaid can retrieve new data on Our behalf. You can also review and revoke connections at any time in Plaid Portal.

Plaid's own security practices are described in the Plaid End User Privacy Policy. If You prefer not to link an account at all, You can upload a CSV export from Your bank instead.

Where Your data lives

• Database and authentication: a managed cloud database hosted in the United States. Data is encrypted at rest, backed up daily, and every table that holds user data is protected by per-user access policies so that a request authenticated as You can only ever read or write Your own records.
• Application servers: Our API, background workers and web app run on managed cloud infrastructure. Secrets (encryption keys, provider API keys) are held as environment secrets and are never committed to source control.
• Passwords for Your Recoup Hero account are never stored in plain text — only a salted, one-way hash is kept. If You sign in with Google, We never see a password at all.
• Uploaded files (CSV exports) are stored in a private storage bucket scoped to Your user id and deleted when You delete them or Your Account.

Analytics and error monitoring

We use third-party product-analytics and error-monitoring services to understand which features are used and to catch errors. Both are configured to minimise personal data:

• Events are keyed to a pseudonymous user id. We never send names, email addresses, institution names, account numbers, order titles or amounts as event properties.
• Session replays mask every form input and every piece of text that looks like a currency amount, an email, a name or an account/order number. Credential forms are blocked from recording entirely.
• We honour the browser "Do Not Track" and Global Privacy Control signals by disabling analytics for that browser.
• Error monitoring is configured not to send personally identifiable information by default.

Who can access Your data

• Production data access is limited to the small team that operates the Service, for the purpose of running and supporting it.
• Decrypting a stored Amazon credential or Plaid token requires the server-side encryption key; it is not possible from the database alone or from the web app.
• Our service providers (listed in the Privacy Policy) process data only as needed to provide their service to Us, under their own security programmes and contractual obligations.

Deleting Your data

From Settings → Delete account You can permanently delete everything in one step. The deletion runs immediately and, in order:

1. Revokes every Plaid connection so no further transactions can be retrieved.
2. Deletes Your Amazon connection data and the encrypted credentials.
3. Deletes Your uploaded files.
4. Deletes Your Account, which cascades to Your orders, transactions, matches, notifications and settings.

Residual copies may persist in encrypted database backups for up to 30 days before they are rotated out. Billing records required by tax law are retained as described in the Privacy Policy.

What We do not (yet) have

We believe in being straightforward about Our current stage. Recoup Hero is an early-stage product and does not yet hold a SOC 2 or ISO 27001 certification, and We do not currently offer a bug-bounty programme. We do rely on providers that hold those certifications (including Plaid and Stripe) and We will update this page as Our own programme matures.

Reporting a security issue

If You believe You have found a vulnerability in Recoup Hero, please email support@recouphero.com with "Security report" in the subject line. We will acknowledge Your report within two business days and keep You informed as We address it. Please do not access other users' data or disrupt the Service while researching.

If You believe Your Account has been compromised, change Your password immediately and contact Us.